How to detect domain under DDOS

We can detect the URL that is referred maximum in the server while DDOS attack, using the 'tcpdump' command.

By the following 'netstat' command, we will be able to get the IP address that is having maximum access in the server.

========
netstat -plane | grep :80 | awk {'print $5'} | cut -d ':' -f1 | sort -n | uniq -c | sort -n
========

This will list the IP address as follows :

-------------
Count  --- IP address
 -------------

From this, take the IP address that is having maximum access and check the
connection from this source IP address using the following commands.

--------------
tcpdump -A src <IP> -s 500 | grep -i refer
--------------
tcpdump -A src <IP> -s 500 | grep -i --color=always refer
--------------

-A   ======== is used to print the output in ASCII format
src  ======== specify the source IP address here
s     ======== to specify the number of hops
-c   ======== can also be used to limit the count to a particular value.

The better option is use the destination IP address ( that is our server IP address) with this command. ie

---------------
tcpdump -A dst <IP> -s 500 | grep -i refer
---------------

Thank you.